# LDAP Search Function to IGNORE an OU

**URL:** <https://forum.inductiveautomation.com/t/ldap-search-function-to-ignore-an-ou/44207>\
**Category:** Ignition\
**Created:** [March 8, 2021, 2:39am UTC](https://forum.inductiveautomation.com/t/ldap-search-function-to-ignore-an-ou/44207 "2021-03-08T02:39:11Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![sith.vader66](https://avatars.discourse-cdn.com/v4/letter/s/8e7dd6/32.png) [@sith.vader66](https://forum.inductiveautomation.com/u/sith.vader66)\
**Post date:** [March 8, 2021, 2:39am UTC](https://forum.inductiveautomation.com/t/ldap-search-function-to-ignore-an-ou/44207/1 "2021-03-08T02:39:12Z")

</div>

Hello all.  
I have been pulling my hair on this and I have done every trigger i could think of and it still isnt working…

I have a BASE DN of: OU=Users, DC=COMPANY, DC=COM  
I have an ObjectClass of User  
and My search Filter code looks like:  
Code:

```auto
!(!employeeID=*))(!(|(employeeID=Contractor)(employeeID=Vendor)(employeeID=<*)(sAMAccountName=a-*)(sAMAccountName=SB-*))
```

 ![PIC 4](https://us1.discourse-cdn.com/inductiveautomation/original/3X/a/c/ac29d4b1b474e5b6d5a440528c2a0302d6546827.jpeg)

When I click ok To this i Get:  
Code:

```auto
(&(|(objectClass=user))(!(!employeeID=*))(!(|(employeeID=Contractor)(employeeID=Vendor)(employeeID=<*)(sAMAccountName=a-*)(sAMAccountName=SB-*))))
```

 ![Pic 1](https://us1.discourse-cdn.com/inductiveautomation/original/3X/9/6/967a3deb9cef27d70571f55ea398b09dc7420aad.jpeg)

This Works Perfectly…

Heres the problem:

I also Need to EXCLUDE in the above Filter:

**OU=FireFighters** ,OU=Users,DC=COMPANY,DC=COM

Ive done every varient you could think of…

!(|(OU=FireFighters))  
(!OU=FireFIghters)  
etc, etc

Any Help with Placement to exclude these guys would be a GREAT HELP, this is my first time doing this, so please bear with me.!!

Thank you so much in advance!

---

<div class="post-metadata">

**Author:** ![lrose](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/lrose/32/62724_2.png) [@lrose](https://forum.inductiveautomation.com/u/lrose)\
**Post date:** [March 8, 2021, 2:55pm UTC](https://forum.inductiveautomation.com/t/ldap-search-function-to-ignore-an-ou/44207/2 "2021-03-08T14:55:12Z")

</div>

> [@sith.vader66](#):
>
> (&(|(objectClass=user))(!(!employeeID=_))(!(|(employeeID=Contractor)(employeeID=Vendor)(employeeID=\<_)(sAMAccountName=a-_)(sAMAccountName=SB-_))))

I think your filter is more complicated than it needs to be.

This section of the filter:

```auto
(|(objectClass=user))(!(!employeeID=*))

```

is equivalent to

```auto
(objectClass=user)(employeeID=*) 

```

which is saying include all users who have an employeeID, which I am guessing is pretty much everyone.

This section of the filter

```auto
(!(|(employeeID=Contractor)(employeeID=Vendor)(employeeID=<)(sAMAccountName=a-*)(sAMAccountName=SB-*))))

```

Is saying:

```auto
NOT (employeeID=Contractor or employeeID=Vendor or employeeID=< or sAMAccountName=a-* or sAMAccountName=SB-*)

```

So in other words, only select users where **none** of those things are true.

So perhaps

```auto
(&(objectClass=user)(!(|(employeeID=Contractor)(employeeID=Vendor)(employeeID=<)(sAMAccountName=a-*)(sAMAccountName=SB-*)(cn=FireFighters)))

```

Here is a decent article on writing filters

---

<div class="post-metadata">

**Author:** ![sith.vader66](https://avatars.discourse-cdn.com/v4/letter/s/8e7dd6/32.png) [@sith.vader66](https://forum.inductiveautomation.com/u/sith.vader66)\
**Post date:** [March 8, 2021, 3:34pm UTC](https://forum.inductiveautomation.com/t/ldap-search-function-to-ignore-an-ou/44207/3 "2021-03-08T15:34:12Z")

</div>

```auto
(!(!employeeID=*))
```

is there to IGNORE people that have an Employee Record as NULL

I did the (!employeeID=\*) but didnt work…but the one above worked…

I am Running your code to test right now, and it still bought in the FireFighters.

```auto
(&(|(objectClass=user))(!(!employeeID=*))(!(|(employeeID=Contractor)(employeeID=Vendor)(employeeID=<*)(sAMAccountName=a-*)(cn=FireFighters))))
```

---

<div class="post-metadata">

**Author:** ![lrose](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/lrose/32/62724_2.png) [@lrose](https://forum.inductiveautomation.com/u/lrose)\
**Post date:** [March 8, 2021, 3:44pm UTC](https://forum.inductiveautomation.com/t/ldap-search-function-to-ignore-an-ou/44207/4 "2021-03-08T15:44:21Z")

</div>

> [@sith.vader66](#):
>
> ```auto
> (!(!employeeID=*))
> 
> ```
> 
> is there to IGNORE people that have an Employee Record as NULL

The equivalent to this would be `(employeeID=*)` the two invertions `!` cancel out.

Perhaps

```auto
(&(objectClass=user)(!(cn=FireFighters))(employeeID=*)(!(|(employeeID=Contractor)(employeeID=Vendor)(employeeID=<)(sAMAccountName=a-*)(sAMAccountName=SB-*))))

```

---

<div class="post-metadata">

**Author:** ![sith.vader66](https://avatars.discourse-cdn.com/v4/letter/s/8e7dd6/32.png) [@sith.vader66](https://forum.inductiveautomation.com/u/sith.vader66)\
**Post date:** [March 8, 2021, 3:49pm UTC](https://forum.inductiveautomation.com/t/ldap-search-function-to-ignore-an-ou/44207/5 "2021-03-08T15:49:34Z")

</div>

```auto
(&(|(objectClass=user))(!(cn=FireFighters))(employeeID=*)(!(|(employeeID=Contractor)(employeeID=Vendor)(employeeID=<)(sAMAccountName=a-*)(sAMAccountName=SB-*))))
```

Still bought in FireFighters

---

<div class="post-metadata">

**Author:** ![lrose](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/lrose/32/62724_2.png) [@lrose](https://forum.inductiveautomation.com/u/lrose)\
**Post date:** [March 8, 2021, 3:52pm UTC](https://forum.inductiveautomation.com/t/ldap-search-function-to-ignore-an-ou/44207/6 "2021-03-08T15:52:11Z")

</div>

Perhaps something a little more verbose

```auto
(!(memberOf=cn=FireFighters,ou=Users,dc=COMPANY,dc=COM))

```

---

<div class="post-metadata">

**Author:** ![sith.vader66](https://avatars.discourse-cdn.com/v4/letter/s/8e7dd6/32.png) [@sith.vader66](https://forum.inductiveautomation.com/u/sith.vader66)\
**Post date:** [March 8, 2021, 3:54pm UTC](https://forum.inductiveautomation.com/t/ldap-search-function-to-ignore-an-ou/44207/7 "2021-03-08T15:54:59Z")

</div>

did that also